Accept a custom key store Id as a KMS origin during create key

[ambrosy-eric]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Currently aws_kms_key only allows for creating a KMS key with a KMS origin. I would like to use a custom key store to create my keys.

KMS allows you to set a custom key store (often a cloudHSM cluster), and then use this key store to generate KMS keys without having to import key material for them directly.

As a developer I would like to be able to define in terraform an origin of my custom key store through its id.

New or Affected Resource(s)

• aws_kms_key

New

• data-source aws_kms_custom_store

Potential Terraform Configuration

data "aws_kms_custom_key_store" "key_store" {
  key_store_id = "my-key-store-name"
}

resource "aws_kms_key" "key" {
  description              = "My key for encrypting"
  custom_key_store   = data.aws_kms_custom_key_store.key_store.id
}

References

• https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
• https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html
• https://docs.aws.amazon.com/sdk-for-go/api/service/kms/#KMS.DescribeCustomKeyStores

[alexis-renard]

Hello, we are still heavily waiting for that new feature to come out. Is there any progress on it, any visibility by chance ? We had to deploy a custom API to deal with our Cloud HSM keys efficiently and securly, and would really like to use terraform to handle our HSM Keys in our workflows (therefore decomissioning our use case specific API).
Thanks !

[bbratchiv]

Hi @justinretzolk, when do you plan to release this feature? I see PR is pending above

[github-actions]

This functionality has been released in v4.33.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.